- What is in this guide
- Introduction
  - Overview
  - Release Notes
  - Introduction
- Setup the Product
  - Setup
  - System Requirements
  - Install and Uninstall
  - Prerequisites
  - Start and Shutdown
  - Connect to Server
  - Database Backup
  - License Details
- Get Started
  - Get Started
  - Add Devices
  - Import Application Logs
  - Monitor AWS EC2 Windows Instance Logs
  - Enable IBM iSeries (AS/400) Audit Logs
- User Interface
  - Tabs
  - Customize Dashboard Views
- EventLog Analyzer Reports
  - EventLog Analyzer Reports
  - Configuring out-of-the-box reports
  - Managing Predefined Reports
  - Managing Report Views
  - Reports for Networking Devices
  - Reports for Windows Environment
  - Reports for Unix Environment
  - Reports for Applications
  - Top and Trend Reports
  - User - based Reports
  - Favourite Reports
  - Reports for vCenter
  - Reports for HP Switches
  - Reports for Arista Devices
  - Reports for Barracuda Devices
  - Reports for CheckPoint Devices
  - Reports for Cisco Firepower Devices
  - Reports for Fortinet Devices
  - Reports for Huawei Devices
  - Reports for Juniper Devices
  - Reports for Malwarebytes Devices
  - Reports for Meraki Devices
  - Reports for NetScreen Devices
  - Reports for Palo Alto Devices
  - Reports for pfSense Devices
  - Reports for SonicWall Devices
  - Reports for Sophos Devices
  - Reports for WatchGuard Devices
  - Reports for F5 Devices
  - Create Custom Reports
  - Schedule Reports
  - Create IBM iSeries (AS/400) custom reports
- Threat Intelligence Data Analytics
  - Threat Intelligence Data Analytics
- Vulnerability Data Analytics
  - Vulnerability Data Analytics
  - Vulnerability reports
- Real-time Event Correlation
  - Real-time Event Correlation
  - Understanding Correlation
  - Correlation Reports
  - Creating Custom Correlation Rules
  - Managing Correlation Rules
  - Activity Reports
  - Configuring External Applications
- Compliance Reports
  - Compliance Reports
  - FERPA Compliance Reports
  - FISMA Compliance Reports
  - PCI DSS Compliance Reports
  - SOX Compliance Reports
  - HIPAA Compliance Reports
  - GLBA Compliance Reports
  - GPG13 Compliance Reports
  - Cyber Essentials Reports
  - ISO 27001:2013 Compliance Reports
  - ISLP Compliance Reports
  - NRC Compliance Reports
  - GDPR Compliance Reports
  - Create New Compliance Reports
  - CoCo Compliance Reports
  - NERC Compliance Reports
  - CCPA Compliance
- Search Logs
  - Search Logs
  - How to Search Logs
  - How to Extract New Fields
  - Tagging Tool
- Alerts
  - Alerts
  - Create Alert Profile
  - View Log Alerts
  - Incident Workflow Management
  - Ticketing Tools Integration
  - Manage Profiles
- - API documentation
  - Installation instruction
  - Snippets
  - API FAQs
- Configurations
  - Configurations
  - Device Management
  - Import Logs
  - Manage Applications
  - File Integrity Monitoring
  - Manage FIM Templates
  - Manage Threat Source
  - Threat Management
  - Threat Whitelisting
  - Advanced Threat Analytics
  - Manage Vulnerability Data
  - Device Group Management
  - Manage vCenter
  - Log Forwarder
- Admin Settings
  - Admin Settings
  - Agent Administration
  - Archive
  - Technicians and Roles
  - Logon Settings
  - Log360 Cloud
  - Domains and Workgroups
  - Working Hour Settings
  - Product Settings
  - DB Retention Settings
  - Log Collection Filter
  - Log Collection Alerts
  - Report Profiles
  - Resource Grouping
  - Custom Log Parser
  - Tags
  - Dashboard Profiles
- System Settings
  - System Settings
  - Notification Settings
  - Manage Account TFA
  - NT Service
  - Connection Settings
  - Re-branding
  - Server Diagnostics
  - Database Access
  - Reset Log Collector
  - Log Level Settings
  - Port Management
- Help, Questions, and Tips
  - Troubleshooting Tips
  - Frequently Asked Questions
  - EventLog Analyzer Help
- Additional Utilities
  - Additional Utilities
  - Working with SSL
  - Configure Microsoft SQL Database
  - Migrate data from PostgreSQL to Microsoft SQL database
  - Migrate data from MySQL to Microsoft SQL database
  - Move Database to Different Directory in the Same Machine
  - Move Installation to Another Machine
  - Migrate Indexes to Latest Version
- Distributed Edition
  - Introduction to Distributed Edition
  - Converting to Admin Server
  - Converting to Managed Server
  - Frequently Asked Questions
- Technical Support
  - Technical Support
  - EventLog Analyzer Support - Create SIF offline
  - EventLog Analyzer Technical Support - Contact

- Related Products
- ADManager Plus

  Active Directory Management & Reporting

  Download | Demo
- ADAudit Plus

  Real-time Active Directory Auditing and UBA

  Download | Demo
- ADSelfService Plus

  Self-Service Password Management

  Download | Demo
- Exchange Reporter Plus

  Exchange Server Auditing & Reporting

  Download | Demo
- AD360

  Integrated Identity & Access Management

  Download | Demo
- Log360

  Comprehensive SIEM and UEBA

  Download | Demo

# EventLog Analyzer Reports

EventLog Analyzer offers a vast collection of over a thousand canned reports, as well as highly flexible custom reports. The reports are displayed in the Reports tab of the UI. The event counts shown in the reports can be drilled down to the raw log level so you can view the actual log information. The logs can be filtered based on various fields.

The reports can be scheduled as required. The custom report profiles can be exported as XML files and later imported to the same or different EventLog Analyzer server machine.

## Description of reports

- Windows
- Unix
- Applications
- Network Devices
- User-based reports
- Top and Trends
- Favorites

#####

##### Windows

The following categories of Windows event reports are available:

- Windows Firewall Threats
- Threat Detection
- Application Whitelisting
- Domain Events
- Hyper-V Server Events
- Application Crashes
- Threat Detection From Antivirus
- Hyper-V VM Management
- Registry Changes
- Infrastructure Reports
- Windows Critical Reports
- Removable Disk Auditing
- Windows System Events
- Windows Severity Reports
- Windows Backup and Restore
- Program Inventory
- Windows Firewall Auditing
- Network Policy Server
- Data Theft Detection

##### Unix

The following categories of Unix event reports are available:

- Unix Logon Reports
- Unix Logoff Reports
- Unix Failed Logon Reports
- Unix User Account Management
- Unix Removable Disk Auditing
- SU Commands
- Unix Mail Server Reports
- Unix Threats
- Unix NFS Events
- Unix Other Events
- Unix FTP Server Reports
- Unix System Events
- Unix Severity Reports
- Unix Risk Reports
- VMWare Logons/Logoff
- VMWare System Events
- VMWare Server Events
- IBM iSeries (AS/400) Reports

#####

##### Applications

ManageEngine EventLog Analyzer supports a wide range of applications, namely Terminal Server, DHCP Windows and Linux Servers, MS IIS W3C FTP Server, MS IIS W3C and Apache Web Servers, MS SQL and Oracle Database Servers and Print Server. It provides the following categories of reports that help you identify the performance and security status of the above mentioned applications:

- Terminal Server Gateway Logons
- Terminal Server Gateway Communications
- Terminal Server Gateway Top Reports
- DHCP Windows Based Server Reports
- DHCP Linux Based Server Reports
- IIS FTP Server Reports
- IIS Web Server Top Reports
- IIS Web Server Error Reports
- IIS Web Server Attack Reports
- Apache Web Server Error Reports
- Apache Web Server Top Reports
- Apache Web Server Attack Reports
- SQL Server Advanced Auditing Reports
- SQL Server DDL Auditing Reports
- SQL Server DML Auditing Reports
- SQL Server Auditing Account Management
- SQL Server Auditing Server Reports
- SQL Server Security Reports
- Oracle Auditing Reports
- Oracle Auditing Account Management
- Oracle Auditing Server Reports
- Oracle Security Reports
- Printer Auditing

#####

##### Network Devices

The following categories of network device event reports are available:

- Router Logon Report
- Router Configuration Report
- Router Accepted Connections
- Router Denied Connections
- Router Traffic Report by Protocol
- Router/Switch System Events
- Router Traffic Errors
- IDS/IPS Activity
- Firewall Threats
- Firewall Traffic Reports
- Firewall Denied Connections
- Firewall Logon Reports
- Firewall Account Management
- Firewall VPN Logon Reports
- Network Device Severity Reports
- Network Device Risk Reports

#####

##### User-based Reports

The following user based reports are available with EventLog Analyzer:

- User Activity Overview
- User Based Reports
- iSeries User Based Reports

These reports present the overview of user activities and user based activity. The user activity overview report provides a snapshot of the most important activities of all the users involved. It can be filtered by device. The user based activity report provides activity details of individual users. It can be filtered by device and user.

##### Top and Trend Reports

Top N Reports

The top n reports available are:

- Top Devices by User Access
- Top Users by Login
- Top Interactive Login
- Top Devices by Event Severity
- Top Processes by Event Severity

The top network activities can be viewed with these reports. The devices accessed by most number of users, users with most logins (successful and failed), devices and processes with the highest number of events of various severity levels, and more are displayed in these reports.

Trend Reports

The trend reports available are:

- Event Severity
- Event category
- Alerts

Current and historical hourly and weekly trends are available. The reports are displayed in both graphical and tabular formats. They can be configured for working and non-working hours. They can also be filtered for individual severity and category.

#####

##### Favorites

This section lists all your favorite reports. You can add the reports that you use most often to this section.

> > Note: For Cisco devices, EventLog Analyzer supports reports for Important Events like: Access List Hits, Configuration Changes, ISDN Disconnects, Link State Changes and System Restarts.

Get download link